A task which is becoming increasingly important in electronics, particularly with regard to security aspects, is to find out how individual devices or circuit parts may be put out of operation permanently and as inexpensively as possible in the event of failure so as to prevent major consequential damage. For example, power semiconductors are nowadays used to a large extent for switching electrical loads such as lamps, valves, engines, heating elements etc., but, additionally, they are increasingly used in the area of performance management for switching off individual circuit parts, for example to reduce the energy consumption of battery-powered apparatuses.
The two typical arrangements of a switch and a current consumer are depicted in FIG. 20. FIG. 20 shows a supply voltage terminal 2, a blow-out fuse 4, a current-consuming load 6, and a power switch 8. Blow-out fuse 4, load 6 and power switch 8 are connected in series, along a current flow direction 10, between supply voltage terminal 2 and ground. Depending on whether the power switch 8 along current flow direction 10 is located closer to supply voltage terminal 2 than is load 6, one speaks of a high-side or a low-side switch, a high-side switch implying that the power switch 8 along current flow direction 10 is arranged closer to supply voltage terminal 2 than is load 6. In order that only little power dissipation be generated in power switch 8, it is important for power switch 8 to exhibit, in the ON state, a very much smaller electrical resistance than load 6. For low-voltage applications, power MOSFETs have been widely accepted as electronic switches. The development towards increasingly low specific forward resistances (RDS(on)×A), which has been very fast in the last few years, has enabled the fact that nowadays currents having a high number of amperes are controllable using semiconductor switches mounted directly on a circuit board, and without using any specific cooling measures.
A further important problem area includes devices which are critical in terms of security and are located directly at the supply voltage. These include all devices which are very likely to exhibit low resistance at the end of their useful lives, when overloaded or in the event of premature failure. In particular, this relates to varistors, multi-layer ceramic capacitors (MLCC) and tantalum electrolytic capacitors as are depicted in FIG. 21. FIG. 21 shows a selection of such security-critical devices which are protected, or fused, by a common blow-out fuse. What is shown are a supply voltage terminal 20, a blow-out fuse 22, a plug-type connection, or cable terminal, 24, a varistor 26, a multi-layer ceramic capacitor 28, and a tantalum electrolytic capacitor 30. Blow-out fuse 22 and plug-type connection 24 are connected in series between the supply voltage terminal 20 and a circuit node 32. Varistor 26, multi-layer ceramic capacitor 28, and tantalum electrolytic capacitor 30 are connected in parallel between circuit node 32 and ground. In the operative state, multi-layer ceramic capacitor 28, tantalum electrolytic capacitor 30 and varistor 26 exhibit a negligible leakage current in the entire admissible operating voltage range and operating temperature range, and thus exhibit negligible static power dissipation. If, however, the leakage current increases in the event of a failure, or if a short-circuit occurs between plates, specifically in multi-layer ceramic capacitors—e.g. due to a breakage caused by mechanical stress—static power dissipation increases to a very high extent and may lead to extreme overheating of a device, since now a large current flow through the device becomes possible without the fuse 22 triggering. What is also critical in terms of security in this respect are any plug-type connections or cable terminals 24 located in the circuit, if these elements, which normally exhibit very low resistance, exhibit a higher resistance or a leakage current—e.g. due to contamination or aging—so that the power dissipation and thus the temperature at these components may increase way beyond the admissible degree.
The problem of a sharp local increase in the operating temperature also arises for a power switch as is shown in FIG. 20. A problem arises when, due to defects in the semiconductor switch or in its control, full switching on or off no longer occurs or is no longer possible. The switch then reaches neither its low nominal forward resistance nor its high-resistance OFF state. Consequently, power dissipation in the switch rises very sharply. In the worst case of the power matching, i.e. when the forward resistance of the switch reaches the range of the value of the load resistance, power dissipation may increase up to a quarter of the nominal power of the load—with non-linear loads such as incandescent lamps, to even higher values. This shall be illustrated below by means of an example. In a power MOSFET having a forward resistance of 10 mΩ, which is used as a switch for a load of 120 W at 12 V, power dissipation of 1 W arises during operation at normal rating. It is to this level of power dissipation that one will adapt the cooling of the MOSFET in a concrete circuit. However, if—due to a failure (e.g. in controlling)—the forward resistance increases, power dissipation in the switch may go up to values of up to 30 W if, in the event of failure, the forward resistance of the power MOSFET has the same magnitude as the ohmic resistance of the load. With a cooling adapted to 1 W, this very quickly leads to dangerously high temperatures or even to a fire hazard with regard to, e.g., the circuit board.
To provide protection against damage caused by exceedingly high currents, current-triggering blow-out fuses are primarily used, these being available in most varied designs and trigger characteristics. Common current-triggering blow-out fuses cannot absorb the occurrence of a defect of a power switch 8 as has been described above, since, as is known, no over-current whatsoever occurs in the circuit of FIG. 20. Load 6 always limits the current to a value which does not exceed the nominal operating current, so that the power dissipation arising at blow-out fuse 4 is too low to cause the material of the blow-out fuse to melt, and to break the circuit. With larger, centrally protected assemblies such as are represented, for example, in FIG. 21, there is the problem that the current which arises, in the event of a failure, at, e.g., the multi-layer ceramic capacitor 28 suffices, on the one hand, to locally generate extreme over-temperature at the multi-layer capacitor 28, but, on the other hand, the current does not reach a value high enough to trigger a centrally arranged blow-out fuse 22. In addition to the blow-out fuses, positive temperature coefficient resistors (PTCs) on a ceramic or polymer basis (e.g. Poly-Switch™) are widely used as an over-current protection. If no over-current occurs, however, as in the event of failure described above, these fuses, too, are not suitable as protection elements. Due to the size, the high cost and particularly the triggering characteristics, for many security-critical devices, PTCs are not suitable protections.
In capacitors, the operating alternating current (ripple current) may clearly exceed the triggering direct current to be called for; in this case, protection with a PTC element and a classic blow-out fuse is, in principle, not possible. PTC elements placed in very close proximity to the component to be protected would, in principle, achieve the task of interrupting a current flow in the event of a very sharp local temperature increase, but for most applications, these elements are not low-resistant enough, or too expensive.
A temperature switch (e.g. a bimetal switch) may also be used as a protection from overheating, but these switches are too bulky to be used on modern SMD-populated assemblies, and too expensive for protecting each individual security-critical component. Wired thermal fuses are utilized, e.g., in coffee machines or irons. With the wired thermal fuses, two current contacts which are mounted with prestress are released from their prestressed position by melting a fuse material, the contacts being spatially separated from one another due to the contacts being unstressed. Due to this construction principle, the wired thermal fuses are too bulky to be used on modern assemblies.
For protecting circuits from over-temperature, temperature sensors are additionally used, it not being possible to achieve a protective function by means of this type of monitoring for above-described failure scenarios of a security-critical device. Merely recognizing over-temperature at a semiconductor switch which is no longer controllable is of no use, since the current flow can no longer be interrupted by intervening in the control voltage of the defective switch.
A further possibility of monitoring circuits is to use a crowbar switch, a crowbar switch being understood to mean an efficient short-circuiting switch capable of triggering an existing central fuse in that it short-circuits a current path to ground, and thus creates a current flow in the circuit which is sufficiently high to cause a blow-out fuse to melt. Due to the high cost and the large amount of space required, crowbar solutions are not suitable for decentralized protective measures, where a multitude of security-critical devices are to be protected individually. A centrally mounted crowbar switch, however, restricts the potential areas of application to a very large extent, since in many applications it is not tolerable, in the event of failure, to put the entire system out of operation rather than only, e.g., one single load current path.